Launching a cosmetic product often hits an unexpected barrier: it cannot be legally sold without a CPSR in place. For many brands, this is where confusion begins, with a sudden introduction to technical and regulatory terminology. Like CPSR. TRA. PIF. MoS. NOAEL. SED, and honestly, it can feel overwhelming if you’re hitting the business world for the first time.
Here’s the fact: it’s not as complicated as it sounds. A Cosmetic Product Safety Report is basically a document that proves your product won’t harm the person using it. A toxicological risk assessment? That’s the science sitting inside it. Two different things, but deeply connected.
This guide helps you understand what a CPSR actually is, to how it differs from a TRA, a PIF, and everything in between. Let’s get started.
What Is a CPSR?
A Cosmetic Product Safety Report (CPSR) is a legally required document for every cosmetic product before it can be sold in the EU or the UK. That’s not optional. Without it, your product cannot be legally placed on the market.
Think of it like an MOT for your product. It proves, on paper, that your cosmetic has been properly evaluated and is safe for the people using it under normal conditions, or even if someone uses it a bit differently than intended.
The regulation behind this is Annex I of Regulation (EC) No 1223/2009, the EU Cosmetics Regulation, which sets out the exact format and content requirements for every CPSR. In the UK post-Brexit, the equivalent framework is Schedule 34 of the Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations 2019 (SI 2019/696). Both are clear: every cosmetic needs a CPSR before it hits shelves.
The Legal Side:
Here’s where businesses sometimes get caught out. The CPSR isn’t just a box-ticking exercise. It carries real legal weight. If your product causes harm and you don’t have a proper cosmetic safety report on file, you’re exposed. Regulatory authorities can pull your product, issue fines, and in serious cases, things escalate significantly.
The document must be kept up to date, too. Change your formula? Update the CPSR. Adjust your preservative system? Update it again. It’s a living document, not a one-time form you file and forget.
What’s Actually Inside a Cosmetic Product Safety Report?
A CPSR has two main parts. And this is where people often get confused, because a lot happens in both. Both parts are needed. One without the other isn’t a complete CPSR assessment.
Part A: Safety Information (The Data Collection Phase)
Part A is everything you know about the product. It’s descriptive and data-driven. Here’s what typically goes in:
- Quantitative formula: every ingredient is listed with its concentration
- Physical and chemical characteristics: pH, viscosity, color, odor
- Microbiological quality: especially important for water-containing products
- Impurities and traces: including contaminants from raw materials such as heavy metals (lead, arsenic, mercury) and residual solvents. For ingredients such as Talc, you must provide proof that they are asbestos-free. This is where purity specifications for cosmetics ingredients evaluation matter significantly
- Packaging material: to keep no chemical migration from the container into the formula
- Normal and easy use: how people actually use the product
- Exposure assessment: how much product contacts skin, eyes, lips, etc.
- Stability data: accelerated studies showing the product holds up over time
- Preservative Efficacy Testing (PET / Challenge Testing to ISO 11930): This proves your preservative system can suppress bacteria, yeast, and mould introduced during consumer use. For any water-containing product, missing PET is a serious gap in Part A
Part B: Safety Assessment (The Expert Judgment Phase)
Part B is where the qualified person, a toxicologist, takes all that data and actually evaluates it. This is the professional opinion section. It includes:
- Toxicological profile of each ingredient
- Margin of Safety (MoS) calculations
- Assessment of special populations (children under 3, people with sensitive skin)
- Evaluation of any restricted or regulated ingredients
- Final safety conclusion, signed by the assessor
This is the cosmetic product safety assessment in its truest sense. It cannot be copied and pasted from another product. It is specific to your formula, your usage pattern, and your consumer.
Who Can Sign a CPSR? Understanding the CPSR Approved Assessor Requirements
Not just anyone can sign off on a cosmetic product safety assessment. This is one of the most important things to understand, and it surprises many small brands.
Under Annex I of Regulation (EC) No 1223/2009, the safety assessor must hold a university degree in pharmacy, toxicology, medicine, or a related discipline recognized by an EU Member State. In the UK, the qualification must be recognized as equivalent by the Secretary of State. Practical experience in the relevant field is also required.
This matters for two reasons.
First, A CPSR signed by someone unqualified is legally invalid, no exceptions at all.
Secondly, the assessor has real legal responsibility, so good ones always check everything carefully.
Finding a CPSR-approved assessor in the UK typically means working with an independent toxicologist or a specialist compliance consultancy. The person doesn’t need to be employed full-time by your business, but their credentials must be verifiable. Always check qualifications before engaging anyone to sign your safety report.
What Is a Toxicological Risk Assessment (TRA)?
A Toxicological Risk Assessment (TRA) is the scientific process used to determine whether an ingredient or a full formula poses a health risk at the level to which someone is actually exposed. It is also used in chemical and toxicological risk assessment contexts well beyond cosmetics, including industrial chemicals, pharmaceuticals, and food-contact materials.
It is not the same as a CPSR. The TRA is a method, and the CPSR is a report. The TRA is included in Part B of the CPSR, but it can also be used on its own.
The cosmetics ingredients evaluation toxicology work you see in Part B is largely built on the findings of the TRA. So they’re inseparable in practice, but they remain fundamentally distinct.
The Four Steps of Toxicological Risk Assessment
This is the gold-standard framework used globally, and it applies directly to cosmetics.
Step 1: Hazard Identification: What can this ingredient actually do to the body? Skin irritation? Eye damage? Carcinogenicity? This step identifies all known toxic effects from available safety data: animal studies, human data, in vitro tests, and published literature.
Step 2: Dose-Response Assessment: How much of something causes harm? This is where the NOAEL (No-Observed-Adverse-Effect Level) comes in. It is the highest dose tested without harmful effects. A higher NOAEL means the ingredient is safer at typical use levels.
Step 3: Exposure Assessment: How much of this ingredient actually reaches the body during normal use? This is calculated using the Systemic Exposure Dose (SED) formula:
SED = (A × C × D) ÷ BW
- A = Amount of product applied daily (grams)
- C = Concentration of the ingredient in the formula
- D = Dermal absorption percentage (from in vitro or literature data)
- BW = Body weight, standardized at 60 kg for adults
A lip balm has much higher oral exposure than a rinse-off shampoo. A leave-on serum used daily carries higher dermal exposure than a weekly face mask. These differences are quantified through the SED.
Step 4: Risk Characterization: Now you combine Steps 2 and 3. Divide the NOAEL by the SED. That gives you the Margin of Safety (MoS).
What Is the Margin of Safety (MoS) and How Is It Calculated?
The Margin of Safety is the buffer between the amount that causes no harm in toxicological studies and the amount someone is actually exposed to when using your product.
The formula:
MoS = NOAEL ÷ SED
A practical example: say your formula contains a preservative with an NOAEL of 500 mg/kg/day from toxicological studies. Your exposure assessment calculates a SED of 2 mg/kg/day. The MoS = 500 ÷ 2 = 250. That comfortably exceeds the gold-standard threshold of 100, meaning the ingredient is considered safe at its intended use level.
If the MoS had come back at, say, 40, the assessor would likely recommend reducing the ingredient’s concentration, restricting the product type (for example, rinse-off use only), or adding a label warning such as “not for use on broken skin.”
For most cosmetic ingredients, an MoS of 100 or above is the accepted minimum. Below that, the assessor must justify any continued use with additional evidence.
CPSR vs Toxicological Risk Assessment: The Real Difference Explained
Let’s put this side by side because this is genuinely where most of the confusion lives.
Key Differences
| Feature | CPSR | Toxicological Risk Assessment (TRA) |
| What it is | A legally required document | A scientific method |
| Scope | Full product: formula, packaging, stability, microbiology | Ingredient toxicity and exposure |
| Legal basis | Mandatory under EU/UK Cosmetics Regulation | Scientific tool used within the CPSR |
| Who uses it | Regulatory bodies, brand owners, assessors | Toxicologists, safety assessors |
| Output | A signed safety report for the product | A Margin of Safety conclusion |
| Evaluates | The finished product | Specific ingredients or the formula |
How They Work Together
The CPSR is the house. The TRA is the foundation underneath it. You can’t have a solid house without a proper foundation, but the foundation alone isn’t the house.
The CPSR pulls together everything: manufacturing standards, stability, packaging safety, microbiology, and regulatory compliance. The TRA contributes the toxicological piece. Both are essential. Submitting a TRA in place of a CPSR is noncompliant and will not withstand regulatory scrutiny.
Which Products Need a CPSR and Which Need a TRA?
Almost every product category needs both. The CPSR is the legal document. The TRA is the science inside it. But the type of TRA, how deep it goes, and which risks it prioritizes change dramatically depending on the product.
| Product / Category | CPSR Required? | TRA Key Focus |
| Skincare, leave-on (serums, moisturizers, eye creams) | Yes | Dermal absorption, daily cumulative exposure, actives at specific concentrations (retinol, AHAs) |
| Makeup, lip products (lipstick, lip gloss, lip balm) | Yes | Oral ingestion route, pigment and colorant safety, accidental daily ingestion estimates |
| Makeup, eye products (mascara, liner, shadow) | Yes | Mucous membrane irritation, sensitization potential, and proximity to the ocular surface |
| Makeup, face/powder (foundation, setting powder) | Yes | Inhalation exposure to loose powders, dermal exposure across a large facial surface area |
| Haircare, rinse-off (shampoo, conditioner) | Yes | Short skin contact time, lower systemic exposure, TRA lighter than leave-on equivalents |
| Haircare, leave-on (serums, oils, styling creams) | Yes | Scalp absorption, extended daily exposure |
| Fragrance and perfume (EDP, EDT, body spray) | Yes | Multi-compound sensitization, IFRA limits per ingredient, inhalation exposure for spray formats |
| Baby and children’s products (lotion, wipes, nappy cream) | Yes | Pediatric exposure factors, thinner infant skin, child body weight, and MoS recalculation |
| Sun care and SPF (sunscreen, SPF moisturizer) | Yes | Phototoxicity, UV filter limits vs Annex VI, large body surface area application |
| Nail products (polish, gel systems, cuticle oil) | Yes | Acrylate sensitization, solvent toxicity, and inhalation risk in salon settings |
| Pharmaceuticals | Separate dossier | Systemic toxicity, drug impurities, ICH Q3 guidelines |
| Food contact materials | Separate dossier | Chemical migration into food, oral exposure modeling |
| Industrial chemicals (REACH) | Separate dossier | Worker exposure, environmental risk, DNEL, and PNEC calculations |
| Medical devices | Separate dossier | Biocompatibility per ISO 10993, cytotoxicity, and sensitization testing |
Why a TRA Alone Is a Compliance Trap
Many brands source ingredients from suppliers that come with an existing toxicological risk assessment or a safety data sheet. While the underlying science may be sound, a supplier TRA is not a CPSR.
Scope: A standalone TRA looks at the hazard profile of a raw material in isolation. A CPSR looks at the exposure of the human using the finished product, in your specific formula, at your concentration, in your packaging, for your intended consumer.
Stability: A TRA doesn’t account for what happens when your formula sits in a warm warehouse for six months or interacts with your packaging material over time. A CPSR, via Part A, does.
The expert declaration: A TRA is data. A CPSR Part B is a legally binding declaration of safety, signed by a qualified assessor who is personally accountable for that conclusion.
If an authority requests your Product Information File and you can only produce a supplier TRA, you are not compliant.
The Legal Architecture: CPSR Certification UK vs EU Post-Brexit
While the science of toxicology is universal, the legal framework is strictly geographical. Since 1 January 2021, the UK and EU have operated separate regulatory regimes. Brands seeking CPSR certification in the UK need to understand exactly what this means in practice.
EU: Regulation (EC) No 1223/2009. In the EU, products must be notified via the CPNP (Cosmetic Products Notification Portal) before being placed on the market. A valid CPSR is a prerequisite for this notification.
UK: The SCPN Portal and SI 2019/696. In Great Britain, the Responsible Person must be established in the UK and carry legal liability for the accuracy of the CPSR. Notification is made via the Submit Cosmetic Product Notifications (SCPN) service. Northern Ireland operates under the EU framework, creating dual-regime considerations for brands selling across the UK.
Special Populations: When the CPSR Requires Extra care
Standard MoS calculations assume an adult consumer with a body weight of 60 kg. For certain product categories and consumer groups, the assessment must go significantly further.
Children Under 3 (Pediatric Safety)
Products intended for or likely to be used on infants and young children require a full pediatric safety evaluation:
- Adjusted body weight: infants weigh significantly less than adults, so the same exposure dose represents a proportionally higher systemic burden. MoS is recalculated using infant body weight norms
- Thinner, more permeable skin: infant skin has higher dermal absorption rates for many compounds, increasing the calculated SED
- Nappy area products: occlusion under the nappy increases absorption, and proximity to mucous membranes adds an additional exposure pathway
A CPSR for a baby lotion, wipe, or nappy cream cannot simply reuse the Part B conclusions from an adult product. The exposure scenario is fundamentally different.
Mucous Membrane and Lip Products
For lipsticks and lip glosses, the estimated daily accidental ingestion (typically around 30 mg/day for leave-on lip products) must be incorporated into the SED calculation. Colorants, pigments, and preservatives are all evaluated against this oral exposure pathway. Eye-area products require assessment of sensitization potential and ocular irritancy.
CPSR vs PIF: Don’t Mix These Up
The Product Information File (PIF) is the full regulatory dossier a brand must maintain for each cosmetic product. Think of it as the master compliance folder. It contains:
- Product description and intended use
- CPNP or SCPN notification records
- GMP compliance evidence (ISO 22716)
- Claims substantiation
- Adverse event and undesirable effects reports
- And the CPSR itself
So the PIF is the container. The cosmetic product safety report is one of the most critical documents. Without a valid CPSR, the entire PIF is incomplete, and an incomplete PIF means you’re not legally compliant.
The key difference is that a PIF covers the business and regulatory aspects of a product. The CPSR covers the safety science. Both are legally required. Neither replaces the other.
What Is CPSR in Pharmacovigilance?
In the cosmetics world, the equivalent of pharmacovigilance is post-market safety monitoring, and the CPSR plays a direct role here.
Brands are required to track consumer complaints, adverse reactions, and any serious undesirable effects after launch. If something unexpected comes up post-launch, the cosmetic safety report must be reviewed and potentially updated. The CPSR is not just a pre-market requirement. It is part of an ongoing cycle of safety assurance throughout a product’s commercial life.
Some larger companies integrate their safety report into broader monitoring systems, tracking adverse events and feeding findings back into their assessment process. That is the best practice under the regulation.
Common CPSR Mistakes (And How to Avoid Them)
A few things that trip people up constantly:
Using a template CPSR: Some people buy a generic cosmetic safety report template and try to fill in the blanks. This rarely works. The assessment has to be product-specific.
Outdated stability data: if your testing was done on an old formula and you’ve since tweaked even one ingredient concentration, that data may no longer be valid.
Wrong assessor qualifications: not every “cosmetic consultant” is qualified to sign a CPSR. Check their degree and field of practice against the Annex I requirements before engaging anyone.
Forgetting to update after reformulation: changed your preservative system? Adjusted a fragrance? That’s a change to the formula, and the CPSR needs updating.
Skipping the exposure assessment: a thorough SED calculation, including reasonable worst-case use scenarios, is critical for accurate MoS conclusions. An assessor who glosses over this is cutting corners.
Missing Preservative Efficacy Testing: for any water-containing product, PET to ISO 11930 is not optional. Without it, microbiological safety cannot be properly substantiated.
FAQs
What is a CPSR assessment?
A CPSR (Cosmetic Product Safety Report) is a legally required, toxicologist-led evaluation that confirms a cosmetic product’s safety. It covers ingredients, formula, stability, packaging, and intended use, concluding with a signed professional safety assessment in two parts.
What is the difference between PIF and CPSR?
The PIF is the complete regulatory dossier containing all product compliance documents. The CPSR is the safety report housed within it. The PIF is the full compliance folder; the CPSR is the safety certificate inside. Both are legally required.
What are the four steps of risk assessment in toxicology?
The four steps are:
- Hazard Identification (what harms can occur?)
- Dose-Response Assessment (at what level?)
- Exposure Assessment (how much contact occurs via SED?)
- Risk Characterization (calculating the Margin of Safety to confirm ingredient safety).
What is CPSR in pharmacovigilance?
In post-market safety monitoring, the CPSR is a living document supporting ongoing oversight. Brands must track adverse reactions after launch. If safety concerns arise, the CPSR must be reviewed and updated throughout the product’s entire market life.
